Ransomware group profile · #237 by claimed victims

Curious Worm ransomware

Curious Worm is a ransomware operation tracked by VULONE since November 2026. Its leak site has named 9 victims since November 2026, 9 of them in the last 30 days. The group most often targets Healthcare, Professional Services, Technology.

Active First seen Nov 2026

9Victims claimed on leak sites

9Victims in the last 30 days

9Victims in the last 90 days

5Countries hit

1Leak-site URLs tracked, 0 online

11 Nov 2026Latest claim recorded

Victimology

Who Curious Worm claims to have breached, from 9 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Healthcare4

Professional Services2

Technology1

Manufacturing1

Top countries

United States4

United Kingdom1

Canada1

Saudi Arabia1

Ireland1

Latest claimed victims 9 most recent

Victim	Sector	Country	Claimed
sacheminc.com sacheminc.com	Manufacturing	CA	11 Nov 2026
sbhny.org sbhny.org	Not Found	US	11 Nov 2026
shannonhealth.com shannonhealth.com	Healthcare	IE	11 Nov 2026
baronandbudd.com baronandbudd.com	Professional Services	GB	11 Nov 2026
raleighortho.com raleighortho.com	Healthcare	US	11 Nov 2026
lifelinescreening.com lifelinescreening.com	Healthcare	US	11 Nov 2026
safcodental.com safcodental.com	Healthcare	SA	11 Nov 2026
marquiscompanies.com marquiscompanies.com	Professional Services	US	11 Nov 2026
atlashp.com atlashp.com	Technology	-	11 Nov 2026

All 9 Curious Worm victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Curious Worm is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Curious Worm ransomware still active?

Curious Worm is tracked as active. The most recent leak-site claim VULONE recorded is dated 11 November 2026. 9 victims were claimed in the last 30 days.

How many victims has Curious Worm claimed?

VULONE has recorded 9 leak-site victim claims attributed to Curious Worm since November 2026, across 5 countries and 5 sectors.

Which industries does Curious Worm target?

The sectors most often named on the Curious Worm leak site are Healthcare, Professional Services, Technology.

Which countries are most affected by Curious Worm?

Most Curious Worm victims recorded by VULONE are located in United States, United Kingdom, Canada.

Where does VULONE get Curious Worm victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 12 November 2026. Questions or corrections: research@vulone.com.